Postal Customer Council Flyer - Data Protection Lunch and Learn on November 14

Metaverse Law to Speak at Postal Customer Council Lunch and Learn

Metaverse Law will be giving a zip talk and participating in a Q&A panel on Thursday, November 14 at the Phoenix Club in Anaheim, CA about Data Protection and Cyber Security.

The event itinerary includes registration at 11:00AM – 11:45AM, followed by lunch and a seminar which conclude at 1:30PM.

Registration details can be found at http://www.socalpcc.org/lock-it-or-lose-it.html.

Lock in "cyber security" word circle and other dot circles

Cybersecurity Ignorance is No Excuse for Tax Professionals

Image Credit: Pete Linforth from Pixabay

Co-authored with Lily Li and Kenny Kang. Mr. Kang is a Certified Public Accountant (CPA), Charted Global Management Accountant (CGMA), and Certified Fraud Examiner (CFE) with a wealth of experience in public accounting and industry.

CPAs and other tax professionals collect their client’s crown jewels: sensitive financial data. This makes them prime targets for cybercriminals. For hackers looking to make a quick buck, or engage in more sophisticated identity theft and tax fraud schemes, tax professionals are a treasure trove of social security numbers, tax ID numbers, bank account numbers, confidential agreements, and other personally identifiable information. Consequently, 3-5 tax practitioners get hacked each week, according to a 2017 webcast by the IRS criminal investigations unit – a number that has likely increased over the last couple of years.

In July 2019, IRS released its own statistics relating to identity theft:

IRS Individual Filing Article “Identity Theft Information for Tax Professionals”

[Page Last Reviewed or Updated: 24-Jul-2019]

An estimated 91 percent of all data breaches and cyberattacks begin with a spear phishing email that targets an individual. The criminal poses as a trusted source, perhaps IRS e-Services, a tax software company or a cloud-storage provider, or the criminal poses as a potential client or professional colleague. The objective is to get the tax professional to open a link or PDF attachment. This allows the thief to steal passwords or download malware that tracks keystrokes or gives the thief control of your computer. 

In light of the rise in cyberattacks against tax practitioners, the IRS has taken notice. For this year’s PTIN renewal season, the IRS has revised Form W-12, IRS Paid Preparer Tax Identification Number (PTIN) (Rev. October 2019) by adding Line 11, which included a mandatory checkbox for tax preparers, requiring them to confirm their awareness of their data security responsibilities. Line 11, Data Security Responsibilities, states:

 As a paid tax return preparer, I am aware of my legal obligation to have a data security plan and to provide data and system security protections for all taxpayer information.  Check the box to confirm you are aware of this responsibility.

This affirmative checkbox applies to licensed tax attorneys, CPAs, enrolled agents, enrolled actuaries, enrolled retirement plan agents, state regulated tax return preparers, certifying acceptance agents, and it should not come as a surprise for tax professionals.

As early as 2008, the IRS released Publication 4557 “Safeguarding Taxpayer Data” under the federal security requirements of the Graham-Leach Bliley Act of 1999 (GLBA). In 2018, the IRS updated Publication 4557 in recognition of the growing crisis of tax preparer data breaches.

In an IRS news release (IR-2018-175, Aug. 28, 2018), the IRS noted that “protecting taxpayer information isn’t just good for the clients and good for business – it’s also the law…tax return preparers must create and enact security plans to protect client data.”

Furthermore, over the 2019 summer, the IRS published a series of news releases: “Tax Security 2.0 – A “Taxes-Security-Together” Checklist” [IR-2019-122, IR-2019-127, IR-2019-131, IR-2019-136, IR-2019-140, IR-2019-143] for tax practitioners to consider as a starting point for analyzing data security. 

IRS, states and industry outline ‘Security Six’ protections to help tax professionals and taxpayers be safer online

IR-2019-127, July 16, 2019

WASHINGTON — Using a new “Taxes-Security-Together” Checklist, the Internal Revenue Service and the Security Summit partners urged tax professionals to review critical security steps to ensure they are fully protecting their computers and email as well as safeguarding sensitive taxpayer data.

The Security Summit partners – the IRS, states and tax industry – urge tax professionals to take time this summer to give their data safeguards a thorough review. To help the tax community, the Summit created a “Taxes-Security-Together” Checklist as a starting point for analyzing office data security.

By failing to enact security plans, and violating the FTC Safeguards Rule (the implementing regulation for the GLBA), the IRS noted this could result in a:

Violation of IRS Publication 3112: Safeguarding of IRS e-file from fraud and abuse is the shared responsibility of the IRS and Authorized IRS e-file Providers.

Violation of IRC, Section 7216: Criminal penalties on any person engaged in the business of preparing or providing services in connection with the preparation of tax returns who knowingly or recklessly makes unauthorized disclosures.

Violation of IRC, Section 6713 – This provision imposes monetary penalties on the unauthorized disclosures or uses of taxpayer information by any person engaged in the business of preparing or providing services in connection with the preparation of tax returns.

Violation of Rev. Proc. 2007-40 – This procedure specifies that violations of the GLB Act and the implementing rules and regulations put into effect by the FTC, as well as violations of non-disclosure rules addressed in IRC sections 6713 and 7216, are considered violations of Revenue Procedure 2007-40. These violations are subject to penalties or sanctions specified in the Revenue Procedure. (See 2007-26)

Now, with an affirmative checkbox, tax professionals cannot claim ignorance of the rules. Instead, they will now have to make a representation of their security compliance. Since Form W-12 is signed under penalty of perjury, making false or misleading information may result in criminal penalties and/or the denial or termination of a PTIN. 

So where should tax professionals start? First of all, the IRS has provided handy resources for tax preparers to understand the FTC Safeguards Rule and their obligations (see links below). Second, per these resources, tax professionals should conduct security risk assessments of their systems (potentially in conjunction with counsel) to mitigate current risks. Third, and finally, stay alert! As hackers get more sophisticated, risks change, and it is up to the tax professional to stay updated on the latest cyber risks or seek the assistance of third parties to manage these ongoing risks.

Publication 4557, Safeguarding Taxpayer Data

Publication 5293, Data Security Resource Guide for Tax Professionals

Identity Theft Information for Tax Professionals

*Disclaimer* This article is not legal advice or legal opinion, and the contents are intended for general informational purposes only. Circumstances may differ from situation to situation. All legal and other issues must be independently researched.

******

******

Gold gavel on platform

California Attorney General Releases Proposed CCPA Regulations

Image Credit: 3D Animation Production Company from Pixabay

California Attorney Xavier Becerra unveiled highly-awaited regulations on October 10, 2019 to enforce the California Consumer Privacy Act, a sweeping new privacy law set to take effect on January 1, 2020.

The text of the CCPA proposed regulation is available here. As a few highlights, the proposed regulation:

  • Defines “categories of sources” and “categories of third parties” to include consumer data resellers, among other types of entities. This shows the Attorney General’s increased scrutiny on data brokers.
  • Requires privacy notices to “[b]e accessible to consumers with disabilities” and “[a]t a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.” This is consistent with recent trends towards ADA website compliance.
  • Requires businesses to either (1) notify consumers of the sale of their data, if they collected the data from third party sources, or (2) confirm or receive signed attestations from the source describing how they provided a notice of collection.
  • Requires greater offline rights to notice and opt-outs of sale, for businesses that substantially interact with consumers offline.
  • Contemplates a button or logo opt-out in a modified version of the regulation.
  • Recognizes the security risks of providing specific pieces of information in response to a request, with requirements around verification of identity and security of transmission.

Individuals and businesses interested in shaping the final CCPA regulations can attend public hearings or send comments by mail or email to the following:

  • Email: PrivacyRegulations@doj.ca.gov
  • Privacy Regulations Coordinator
    California Office of the Attorney General
    300 South Spring Street, First Floor
    Los Angeles, CA 90013

The public hearing dates and locations are as follows:

Public Hearing DatesLocations
Sacramento
December 2, 2019
10:00 a.m.
CalEPA Building
Coastal Room, 2nd Floor
1001 I Street
Sacramento, CA 95814
Los Angeles
December 3, 2019
10:00 a.m.
Ronald Reagan Building
Auditorium, 1st Floor
300 S. Spring Street
Los Angeles, CA 90013
San Francisco
December 4, 2019
10:00 a.m.
Milton Marks Conference Center
Lower Level
455 Golden Gate Ave.
San Francisco, CA 94102
Fresno
December 5, 2019
10:00 a.m.
Fresno Hugh Burns Building
Assembly Room #1036
2550 Mariposa Mall
Fresno, CA 93721

More information about the public hearings and proposed CCPA regulation is available on the Attorney General’s CCPA website.

File folders with a small lock in the corner

Will the CCPA and Other State Privacy Laws Face Constitutional Attack?

Image Credit: Pettycon from Pixabay

This article is Part 2 of 3 in a series exploring proposed federal privacy laws and constitutional concerns of privacy laws in the United States. Part 3 will discuss the constitutional challenges facing a proposed federal privacy law. 

In the first part of this series, we examined several federal privacy bills proposed this year, as Congress eagerly tries to pass a single harmonizing federal law. The issue of preemption continues to divide Republican and Democrat lawmakers, however, with the former in favor of an express provision allowing preemption stricter state privacy laws such as the CCPA and the latter largely against such a provision. 

Regardless of whether a federal law passes, with an express preemption provision, state privacy laws are still at risk of constitutional attacks. There are two primary ways that a state privacy law may be challenged: (1) invalidation under the Dormant Commerce Clause, and (2) invalidation under First Amendment grounds. State legislators contemplating the passage of their own privacy laws will need to consider these constitutional issues in the drafting phase, or risk facing opposition on constitutional grounds.

Dormant Commerce Clause

Extraterritoriality

Under the Dormant Commerce Clause, the doctrine of extraterritoriality invalidates state laws attempting to regulate commerce that occurs outside state borders. See Edgar v. MITE Corp., 457 U.S. 624, 642–643. Even if legislators did not intend a law to reach extraterritorially, that intention is not definitive of whether the law regulates commerce outside state borders. “The critical inquiry is whether the practical effect of the regulation is to control conduct beyond the boundaries of the State.” Healy v. Beer Inst., Inc., 491 U.S. 324, 336 (1989) (citing Brown-Forman Distillers Corp. v. N. Y. State Liquor Auth., 476 U.S. 573, 579 (1986)).

In evaluating a law’s extraterritorial reach, judges must also “[consider] how the challenged statute may interact with the legitimate regulatory regimes of other States and what effect would arise if not one, but many or every, State adopted similar legislation.” Healy, 491 U.S. at 336. The broad purpose of the Commerce Clause is to prevent one state from encroaching jurisdiction lines and imposing its own regulatory schema onto another state, and reducing onerous inconsistencies in legislation.

Therefore, the critical question becomes: does a state’s privacy law attempt to regulate commerce outside of state borders? 

Considering the nature of the internet—most likely yes. “The Internet is a decentralized, global communications medium linking people, institutions, corporations, and governments all across the world.” Am. Libraries Ass’n v. Pataki, 969 F. Supp. 160, 164 (S.D.N.Y. 1997). Given that the purpose of the Internet is to facilitate far-reaching communications between people and organizations across both state and country lines, a state’s privacy law will almost certainly regulate commerce outside state borders in practice, if not intentionally so. Many companies process data of internet visitors without gathering geolocation data. In such cases, rather than risk noncompliance, some businesses will ostensibly choose to comply with all state privacy laws regardless of the location of its customers. For instance, a small business located outside of California with minimal contacts with California consumers may have little choice but to comply with the CCPA if it has no idea where its users are located. Practically speaking, a state privacy law will invariably affect commerce outside state borders. 

Furthermore, the effects of privacy enforcement will be more apparent once more state and local governments pass their own privacy laws. The term “patchwork” is often used to describe state and local privacy laws today—but it could look even more disjointed. Theoretically, if every state passed its own version of California’s CCPA, then compliance with all 50 state privacy laws may not be feasible, if there are inconsistent instructions. Businesses already see this happening with state breach notification laws. Each law dictates its own special rules and thresholds for notifying the state Attorney General, state Department of Health Services, or other authority, as well as time to notification and contents of notification. 

Pike v. Bruce Church, Inc.

Even if a law may incidentally regulate extraterritorial commerce, that law may be justified when subjected to a balancing test weighing the burden of the law against a legitimate state interest. See Pike v. Bruce Church, Inc., 397 U.S. 137 (1970). In Pike, the Supreme Court held that a state law serving a legitimate interest is only invalid when “the burden imposed on [interstate] commerce is clearly excessive in relation to the putative local benefits.” Pike, 397 U.S. at 142.

The question then becomes: do the benefits to consumer privacy protection resulting from a state’s privacy law outweigh any burden on interstate commerce?

This is likely where the true battle will be fought. In 2017, the cost of privacy compliance for multinational companies ranged from $1.4 million to $21.6 million, with a median cost of $4 million per company. Predictably, a fair portion of these total costs include the price of compliance with a multitude of state and local privacy laws. Privacy compliance is a costly endeavor widely impacting organizational, operational, and technical business processes and will likely continue to grow in the next ten years. Despite these sky-rocketing costs, many opine that state privacy laws, even the most stringent laws like the CCPA, do not actually provide consumers with significant protection. There is much room for argument in this area and the balancing of interests will continue to shift as costs change and the benefits to consumers become more concrete.

American Libraries Association v. Pataki

The Dormant Commerce Clause has already been invoked to analyze the constitutionality of a state law regulating internet activity. In 1997, the U.S. District Court for the Southern District of New York overturned a state law prohibiting the online dissemination of content depicting “nudity, sexual conduct or sado-masochistic abuse” to minors. Pataki, 969 F. Supp. at 163. The plaintiffs to the action included content-providing library organizations and the ACLU, among others, who sought to enjoin enforcement of the law for fear of prosecution.

The limitation of this case is obvious—being only a federal trial court opinion, it cannot command precedent as mandatory authority. However, Pataki provides persuasive authority and a line of reasoning that other courts may adopt in the context of Internet regulation.

First Amendment

A court may also invalidate a state’s privacy law if it finds a violation of a speaker’s First Amendment right to free speech.

Judges examine the constitutionality of laws through several levels of scrutiny depending on the interests involved. For example, in the context of First Amendment rights, political and ideological speech is generally protected under the strict scrutiny standard. If the government regulates political or ideological speech, the government must show that the law is narrowly tailored to achieve a compelling government interest. However, judges examine laws regulating commercial speech—regarded as less important to protect—with intermediate scrutiny. Restrictions that are based on the content of speech or the identity of the speaker receive a “heightened” scrutiny—somewhere in between intermediate and strict scrutiny. Therefore, the type of speech that a privacy law purports to regulate will be very significant to the determination of which standard to apply, and by proxy, whether it is likely to be found constitutional or unconstitutional.

Finally, First Amendment jurisprudence not only protects the rights of speakers, but also the rights of listeners to access papers, information, and ideas. While individuals more frequently wield First Amendment law as a shield rather than a sword, some have argued for access to public court records using First Amendment law as a sword when those records are in danger of deletion due to privacy concerns. (For more in-depth discussion on the right to access public court records subject to a “right to deletion” or “right to be forgotten” request, please see Personal Privacy Should Not Outweigh Access to Public Court Records.)

Sorrell v. IMS Health Inc.

In Sorrell, a Vermont law prohibited the sale of pharmacy records (“prescriber-identifying information”) that tracked doctors’ prescribing practices to marketers of pharmaceutical and drug companies. The intended purpose of the law was to protect medical privacy. The Supreme Court struck down the law, finding it to be a content-based restriction of commercial speech because the law prohibited the disclosure of records for marketing purposes, but not for others, such as for research or educational purposes. Therefore, the Vermont law was subject to a heightened scrutiny standard. Under the heightened standard, the Court did not find the law necessary to protect medical privacy.

Sorrell is instrumental for the proposition that a state law’s limitations on who may receive data may lead the court to a finding that the law restricts speech based on content or speaker, leading to application of a heightened scrutiny standard. Notably, the dicta in the opinion also points to possible treatment of the processing and sale of data as speech worthy of First Amendment protections—not as conduct nor a commodity.

While federal lawmakers continue to debate over the provisions to be included in a federal privacy law, state legislators may themselves be deliberating over whether to pass a state privacy law as a gap filler. However, any state legislator should consider the above issues and work proactively to eliminate constitutional concerns through careful drafting.

Gold gavel on platform

Searching for the One Ring to Rule Them All: A Look at 8 U.S. Federal Privacy Bills

Image Credit: 3D Animation Production Company from Pixabay

This article is Part 1 of 2 in a series exploring proposed federal privacy laws in the United States. Part 2 will discuss the constitutional challenges facing not only a proposed federal privacy law but those facing existing state privacy laws as well.

As predicted in our Privacy Law Forecast for 2019, legislators have raced to introduce national privacy regulation in both the House and Senate this year.

In contrast to the European Union’s GDPR, a hodgepodge of sectoral laws govern privacy in specific industries: medical, financial, educational, and marketing sectors, among others. States have enacted laws to protect their residents. And on top of that, Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) grants authority to the FTC to enforce against unfair and deceptive acts and practices.

This all results in a confusing and burdensome “patchwork” of national, state and sectoral rules. (For more in-depth discussion on the current U.S. privacy regulatory landscape, please see American Privacy Laws in a Global Context.)

Given this regulatory environment, legislators are keen to put forth a single federal privacy law to standardize this “patchwork” and forestall the passage of dozens more state privacy bills. Some have set a deadline, hoping to pass a federal privacy law before the CCPA comes into effect on January 1, 2020. Since the start of 2019, lawmakers have introduced about 230 bills that regulate privacy in some way in either the House or Senate.

The following is a sample of comprehensive bills from both sides of the aisle. Though these bills are unlikely to pass committee, they indicate what policies lawmakers are considering in the current negotiations:

Title Introduction Date Sponsor Notes
American Data Dissemination Act of 2019 (“ADD Act”) January 16, 2019 Senator Marco Rubio (R-FL) This bill would require the FTC to submit recommended privacy regulations on “covered providers” (defined as any person that provides services over the internet) to Congress. If Congress fails to enact a law based on the FTC’s recommendations, the FTC would promulgate a final rule incorporating its proposed regulations. Only the FTC has powers of enforcement. This bill further allows for the preemption of state law.
Social Media Privacy Protection and Consumer Rights Act of 2019 January 17, 2019 Senator Amy Klobuchar (D-MN) This bill would require online platforms to inform the user of any data collection and use, offer the user a copy of their personal data, and allow the user to opt out of data tracking. The bill also requires breach notification within 72 hours of detection. Only the FTC and state attorneys general have the power to enforce violations.
Digital Accountability and Transparency to Advance Privacy Act (“DATA Privacy Act”) February 27, 2019 Senator Catherine Cortez Masto (D-NV) This bill would require companies to provide users with a fair processing notice and to allow users to access, port, or delete their own records. It would mandate users’ opt-in consent in situations involving sensitive data or data outside the parameters of the business-consumer relationship. Companies that collect data on more than 3,000 people a year and revenues greater than $25 million per year must appoint a Data Protection Officer (DPO). The FTC, state attorneys general, and any other officer authorized by the State to bring civil actions would have the power to enforce this law.
Own Your Own Data Act March 14, 2019 Senator John Kennedy (R-LA) This bill would require social media companies to have a “prominently and conspicuously displayed icon” that a user can click to easily access and port their information. It would characterize user account registration as a “licensing agreement” wherein the user would license the user’s data to the social media company.
Information Transparency & Personal Data Control Act April 1, 2019 Representative Suzan DelBene (D-WA) This bill would require any company to first procure users’ opt-in consent before processing sensitive data. Companies must also provide users with fair processing information. The bill requires companies to obtain third-party privacy audits and to submit the audits to the FTC biannually. Only the FTC would enforce this law. This bill further allows for the preemption of state law.
Balancing the Rights of Web Surfers Equally and Responsibly Act of 2019 (“BROWSER Act”) April 10, 2019 Senator Marsha Blackburn (R-TN) This bill would require providers of broadband internet access service and edge services to notify users of the providers’ privacy policies; obtain users opt-in consent in order to process sensitive information and opt-out consent for non-sensitive information; and prohibits providers from conditioning services on waivers of privacy rights. The bill further allows for the preemption of state law.
Privacy Bill of Rights April 11, 2019 Senator Edward Markey (D-MA) This bill would require companies provide users with fair processing information and the right to access, port, or delete their own records. Companies would be prohibited from offering “take-it-or-leave-it” arrangements or financial incentives in exchange for users’ personal information. Companies would also have to procure users’ opt-in consent before processing personal information. Under this bill, companies must designate an employee in charge of privacy/security compliance, no matter the size or annual revenue of the company. The FTC, state attorneys general, and individuals would be able to sue to enforce the law.
Do Not Track Act May 21, 2019 Senator Josh Hawley (R-MO) This bill would establish a national Do Not Track (DNT) system and require any website or application operator to search for a DNT signal upon connection. The bill would make it illegal to collect data from devices displaying a DNT signal. Only the FTC and state attorneys general have the power to enforce violations.

As we can see, the fault lines are clear and not surprising. Democratic lawmakers generally favor a private right of action for consumers to sue a company that has mishandled consumer data. Republican lawmakers are generally against including such a provision. Republican lawmakers typically favor an express right of preemption, so that a laxer federal privacy law may preempt stringent state laws such as the CCPA. Democratic lawmakers are largely against the inclusion of such provisions, unless the bill provides consumer rights equivalent in scope and depth to the CCPA.

Regardless of whether or not a federal privacy law passes, businesses and the courts have their work cut out for them. Constitutional and interpretive challenges will plague the reach of any state or federal comprehensive privacy law, making it difficult to assess coverage for overlapping sector, state, and federal rules.

Consequently, as we will discuss further in our next article, legislators should consider these constitutional challenges head on prior to passing the “one” best bill to rule them all. Without clearly articulating the scope of any privacy law (e.g. does it extend across state borders and internationally), its preemption over or exclusions for other laws (e.g. GLBA, HIPAA, COPPA), and its relationship to third parties that only touch data incidentally – any comprehensive legislation will just add to the quagmire of current laws.

1 2 3 4